Protocol definition for software bridge failover

ABSTRACT

A method, data processing system, and computer usable code are provided for protocol definition for software bridge failover. In a first aspect of the present invention, a first software bridge determines the proper working operation of a physical adapter. Limbo packets are sent to a second software bridge alerting the second software bridge that the first software bridge is no longer bridging traffic responsive to the physical adapter failure in the first software bridge. The second software bridge receives the limbo packets, and, in response to receiving the limbo packets, asserts primary control and initiates bridging of traffic. In an alternative aspect of the present invention a first software bridge sends keep-alive packets. A second software bridge monitors the keep-alive packets from the first software bridge and, in response to a failure to detect the keep-alive packets from the first software bridge, the second software bridge initiates bridging of traffic.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates generally to software bridge failure. Morespecifically, the present invention relates to a protocol definition forsoftware bridge failover.

2. Description of the Related Art

Virtual Ethernet technology is supported on systems, such as AIX 5L™V5.3 on POWER5™ hardware. This technology enables IP-based communicationbetween logical partitions on the same system using a virtual local-areanetwork capable software switch in POWER5™ systems. Shared EthernetAdapter (SEA) technology enables the logical partitions to communicatewith other systems outside the hardware unit without assigning physicalEthernet slots to the logical partitions.

Virtual networking along with other POWER5™ virtualization technologiesoffers greater flexibility in configuration scenarios. Workloads can beeasily consolidated with more control over resource allocation. Networkavailability can also be improved for more systems with fewer resourcesusing a combination of Virtual Ethernet, Shared Ethernet and linkaggregation in the Virtual I/O server. When there are not enoughphysical slots to allocate a physical network adapter to each logicalpartition network access using Virtual Ethernet and a Virtual I/O serveris preferable to IP forwarding as it does not complicate the IP networktopology.

Virtual local-area network is described by the IEEE 802.1Q standard.Virtual local-area network is a method to logically segment a physicalnetwork such that layer 2 connectivity is restricted to members thatbelong to the same virtual local-area network. This separation isachieved by tagging Ethernet packets with their virtual local-areanetwork membership information and then restricting delivery to membersof that virtual local-area network.

The virtual local-area network tag information is referred to as virtuallocal-area network identifier. Ports on a switch are configured as beingmembers of virtual local-area network designated by the virtuallocal-area network identifier for that port. The default virtuallocal-area network identifier for a port is referred to as the portvirtual local-area network identifier. The virtual local-area networkidentifier can be added to an Ethernet packet either by a virtuallocal-area network aware host or by the switch in the case of virtuallocal-area network unaware hosts.

Therefore, ports on an Ethernet switch have to be configured withinformation indicating whether the host connected is virtual local-areanetwork aware or unaware. For virtual local-area network unaware hosts,a port is set up as untagged and the switch will tag all packetsentering through that port with the port virtual local-area networkidentifier. It will also untag all packets exiting that port beforedelivery to the virtual local-area network unaware host. A port used toconnect virtual local-area network unaware hosts is called an untaggedport, and it can only be a member of a single virtual local-area networkidentified by its port virtual local-area network identifier.

Hosts that are virtual local-area network aware can insert and removetheir own tags and can be members of more than one virtual local-areanetwork. These hosts are typically attached to ports that do not removethe tags before delivering the packets to the host, but will insert theport virtual local-area network identifier tag when an untagged packetenters the port. A port will only allow packets that are untagged ortagged with the tag of one of the virtual local-area networks the portbelongs to. These virtual local-area network rules are in addition tothe regular media access control address based forwarding rules followedby a switch. Therefore, a packet with a broadcast or multicastdestination media access control will also get delivered to member portsthat belong to the virtual local-area network that is identified by thetags in the packet. This mechanism ensures the logical separation ofphysical network based on membership in a virtual local-area network.

As virtual local-area network ensures logical separation at layer 2, itis not possible to have an IP network that spans multiple virtuallocal-area networks. A router that belongs to both virtual local-areanetwork segments and forwards packets between them is required tocommunicate between hosts on different virtual local-area networksegments. However, a virtual local-area network can extend acrossmultiple switches by ensuring that the virtual local-area networkidentifiers remain the same and the trunk ports are configured with theappropriate virtual local-area network identifiers. Typically a virtuallocal-area network capable switch will have a default virtual local-areanetwork defined. The default setting for all its' ports is such thatthey belong to the default virtual local-area network and, therefore,have a port virtual local-area network identifier and assume that allhosts connecting will be virtual local-area network unaware. Thissetting makes such a switch equivalent to a simple Ethernet switch thatdoes not support virtual local-area networks.

On AIX 5L™, virtual local-area network tagging and untagging isconfigured by creating a virtual local-area network device over aphysical (or virtual) Ethernet device and assigning it a virtuallocal-area network tag identifier address, which is then assigned on theresulting interface associated with the virtual local-area networkdevice. AIX 5L™ supports multiple virtual local-area network devicesover a single Ethernet device each with its own virtual local-areanetwork identifier. Each of these virtual local-area network devices isan endpoint to access the logically separated physical Ethernet networkand the interfaces associated with them are configured with IP addressesbelonging to different networks.

In general, configuration is simpler when ports are untagged and onlythe port virtual local-area network identifier is configured because theattached hosts do not have to be virtual local-area network aware andthey do not require any virtual local-area network configuration.However, this scenario has the limitation that a host can access only asingle network using a physical adapter. Therefore, untagged ports withport virtual local-area network identifiers only are preferred whenaccessing a single network per Ethernet adapter and additional virtuallocal-area network identifiers should be used only when multiplenetworks are being accessed through a single Ethernet adapter.

Thus, machines that can be logically partitioned into severalindependent operating system images may need to employ a software bridgeto be able to transmit network traffic generated within the logicalpartitions to the outside world. This software bridge will receive allthe traffic generated by the virtual Ethernet network used forinter-logical partition communication and send it out to the outsideworld through a physical Ethernet adapter. The software bridge residesin a special administrative partition called the hosting partition.

A problem exists when the hosting partition fails for any reason, suchas the physical Ethernet adapter in the software bridge fails, or if thenetwork switch that the physical Ethernet adapter is connected to fails.If the hosting partition fails, all internal logical partitions willalso lose their connectivity to the outside world.

SUMMARY OF THE INVENTION

The different aspects of the present invention provide a method, dataprocessing system, and computer usable code for protocol definition forsoftware bridge failover. The proper working operation of a physicaladapter in a first software bridge is determined. In response to aphysical adapter failure in the first software bridge, limbo packets aresent to a second software bridge alerting the second software bridgethat the first software bridge is no longer bridging traffic. The secondsoftware bridge asserts primary control and initiates bridging oftraffic in response to the receipt of the limbo packets.

BRIEF DESCRIPTION OF THE DRAWINGS

The novel features believed characteristic of the invention are setforth in the appended claims. The invention itself, however, as well asa preferred mode of use, further objectives and advantages thereof, willbest be understood by reference to the following detailed description ofan illustrative embodiment when read in conjunction with theaccompanying drawings, wherein:

FIG. 1 depicts a pictorial representation of a network of dataprocessing systems in which aspects of the present invention may beimplemented;

FIG. 2 depicts a block diagram of a data processing system in whichaspects of the present invention may be implemented;

FIG. 3 depicts a functional block diagram of a data processing systemwith a software bridge failover in accordance with an illustrativeembodiment of the present invention;

FIG. 4 is a flowchart of a software bridge initialization in accordancewith an illustrative embodiment of the present invention;

FIG. 5 is a flowchart of a primary software bridge operation inaccordance with an illustrative embodiment of the present invention; and

FIG. 6 is a flowchart of a backup software bridge operation inaccordance with an illustrative embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

The aspects of the present invention relate to a protocol definition forsoftware bridge failover. With reference now to the figures, and inparticular with reference to FIG. 1, a block diagram of a dataprocessing system in which the present invention may be implemented isdepicted. Data processing system 100 may be a symmetric multiprocessor(SMP) system including a plurality of processors 101, 102, 103, and 104,which connect to system bus 106. For example, data processing system 100may be an IBM eServer, a product of International Business MachinesCorporation in Armonk, N.Y., implemented as a server within a network.Alternatively, a single processor system may be employed. Also connectedto system bus 106 is memory controller/cache 108, which provides aninterface to a plurality of local memories 160-163. I/O bus bridge 110connects to system bus 106 and provides an interface to I/O bus 112.Memory controller/cache 108 and I/O bus bridge 110 may be integrated asdepicted.

Data processing system 100 is a logical partitioned (LPAR) dataprocessing system. Thus, data processing system 100 may have multipleheterogeneous operating systems (or multiple instances of a singleoperating system) running simultaneously. Each of these multipleoperating systems may have any number of software programs executingwithin it. Data processing system 100 is logically partitioned such thatdifferent PCI I/O adapters 120-121, 128-129, and 136, graphics adapter148, and hard disk adapter 149 may be assigned to different logicalpartitions. In this case, graphics adapter 148 connects for a displaydevice (not shown), while hard disk adapter 149 connects to and controlshard disk 150.

Thus, for example, suppose data processing system 100 is divided intothree logical partitions, P1, P2, and P3. Each of PCI I/O adapters120-121, 128-129, 136, graphics adapter 148, hard disk adapter 149, eachof host processors 101-104, and memory from local memories 160-163 isassigned to each of the three partitions. In these examples, memories160-163 may take the form of dual in-line memory modules (DIMMs). DIMMsare not normally assigned on a per DIMM basis to partitions. Instead, apartition will get a portion of the overall memory seen by the platform.For example, processor 101, some portion of memory from local memories160-163, and I/O adapters 120, 128, and 129 may be assigned to logicalpartition P1; processors 102-103, some portion of memory from localmemories 160-163, and PCI I/O adapters 121 and 136 may be assigned topartition P2; and processor 104, some portion of memory from localmemories 160-163, graphics adapter 148 and hard disk adapter 149 may beassigned to logical partition P3.

Each operating system executing within data processing system 100 isassigned to a different logical partition. Thus, each operating systemexecuting within data processing system 100 may access only those I/Ounits that are within its logical partition. Thus, for example, oneinstance of the Advanced Interactive Executive (AIX) operating systemmay be executing within partition P1, a second instance (image) of theAIX operating system may be executing within partition P2, and a Linuxor OS/400 operating system may be operating within logical partition P3.

Peripheral component interconnect (PCI) host bridge 114 connected to I/Obus 112 provides an interface to PCI local bus 115. A number of PCIinput/output adapters 120-121 connects to PCI bus 115 through PCI-to-PCIbridge 116, PCI bus 118, PCI bus 119, I/O slot 170, and I/O slot 171.PCI-to-PCI bridge 116 provides an interface to PCI bus 118 and PCI bus119. PCI I/O adapters 120 and 121 are placed into I/O slots 170 and 171,respectively. Typical PCI bus implementations support between four andeight I/O adapters (i.e. expansion slots for add-in connectors). EachPCI I/O adapter 120-121 provides an interface between data processingsystem 100 and input/output devices such as, for example, other networkcomputers, which are clients to data processing system 100.

An additional PCI host bridge 122 provides an interface for anadditional PCI bus 123. PCI bus 123 connects to a plurality of PCI I/Oadapters 128-129. PCI I/O adapters 128-129 connect to PCI bus 123through PCI-to-PCI bridge 124, PCI bus 126, PCI bus 127, I/O slot 172,and I/O slot 173. PCI-to-PCI bridge 124 provides an interface to PCI bus126 and PCI bus 127. PCI I/O adapters 128 and 129 are placed into I/Oslots 172 and 173, respectively. In this manner, additional I/O devices,such as, for example, modems or network adapters may be supportedthrough each of PCI I/O adapters 128-129. Consequently, data processingsystem 100 allows connections to multiple network computers.

A memory mapped graphics adapter 148 is inserted into I/O slot 174 andconnects to I/O bus 112 through PCI bus 144, PCI-to-PCI bridge 142, PCIbus 141, and PCI host bridge 140. Hard disk adapter 149 may be placedinto I/O slot 175, which connects to PCI bus 145. In turn, this busconnects to PCI-to-PCI bridge 142, which connects to PCI host bridge 140by PCI bus 141.

A PCI host bridge 130 provides an interface for a PCI bus 131 to connectto I/O bus 112. PCI I/O adapter 136 connects to I/O slot 176, whichconnects to PCI-to-PCI bridge 132 by PCI bus 133. PCI-to-PCI bridge 132connects to PCI bus 131. This PCI bus also connects PCI host bridge 130to the service processor mailbox interface and ISA bus accesspass-through logic 194 and PCI-to-PCI bridge 132. Service processormailbox interface and ISA bus access pass-through logic 194 forwards PCIaccesses destined to the PCI/ISA bridge 193. NVRAM storage 192 connectsto the ISA bus 196. Service processor 135 connects to service processormailbox interface and ISA bus access pass-through logic 194 through itslocal PCI bus 195. Service processor 135 also connects to processors101-104 via a plurality of JTAG/I²C busses 134. JTAG/I²C busses 134 area combination of JTAG/scan busses (see IEEE 1149.1) and Phillips I²Cbusses. However, alternatively, JTAG/I²C busses 134 may be replaced byonly Phillips I²C busses or only JTAG/scan busses. All SP-ATTN signalsof the host processors 101, 102, 103, and 104 connect together to aninterrupt input signal of service processor 135. Service processor 135has its own local memory 191 and has access to the hardware OP-panel190.

When data processing system 100 is initially powered up, serviceprocessor 135 uses the JTAG/I²C busses 134 to interrogate the system(host) processors 101-104, memory controller/cache 108, and I/O bridge110. At the completion of this step, service processor 135 has aninventory and topology understanding of data processing system 100.Service processor 135 also executes Built-In-Self-Tests (BISTs), BasicAssurance Tests (BATs), and memory tests on all elements found byinterrogating the host processors 101-104, memory controller/cache 108,and I/O bridge 110. Any error information for failures detected duringthe BISTs, BATs, and memory tests are gathered and reported by serviceprocessor 135.

If a meaningful/valid configuration of system resources is stillpossible after taking out the elements found to be faulty during theBISTs, BATs, and memory tests, then data processing system 100 isallowed to proceed to load executable code into local (host) memories160-163. Service processor 135 then releases host processors 101-104 forexecution of the code loaded into local memory 160-163. While hostprocessors 101-104 are executing code from respective operating systemswithin data processing system 100, service processor 135 enters a modeof monitoring and reporting errors. The type of items monitored byservice processor 135 include, for example, the cooling fan speed andoperation, thermal sensors, power supply regulators, and recoverable andnon-recoverable errors reported by processors 101-104, local memories160-163, and I/O bridge 110.

Service processor 135 saves and reports error information related to allthe monitored items in data processing system 100. Service processor 135also takes action based on the type of errors and defined thresholds.For example, service processor 135 may take note of excessiverecoverable errors on a processor's cache memory and decide that this ispredictive of a hard failure. Based on this determination, serviceprocessor 135 may mark that resource for deconfiguration during thecurrent running session and future Initial Program Loads (IPLs). IPLsare also sometimes referred to as a “boot” or “bootstrap”.

Data processing system 100 may be implemented using various commerciallyavailable computer systems. For example, data processing system 100 maybe implemented using IBM eServer iSeries Model 840 system available fromInternational Business Machines Corporation. Such a system may supportlogical partitioning using an OS/400 operating system, which is alsoavailable from International Business Machines Corporation.

Those of ordinary skill in the art will appreciate that the hardwaredepicted in FIG. 1 may vary. For example, other peripheral devices, suchas optical disk drives and the like, also may be used in addition to orin place of the hardware depicted. The depicted example is not meant toimply architectural limitations with respect to the present invention.

With reference now to FIG. 2, a block diagram of an exemplary logicalpartitioned platform is depicted in which the present invention may beimplemented. The hardware in logical partitioned platform 200 may beimplemented as, for example, data processing system 100 in FIG. 1.Logical partitioned platform 200 includes partitioned hardware 230,operating systems 202, 204, 206, 208, and partition management firmware210. Operating systems 202, 204, 206, and 208 may be multiple copies ofa single operating system or multiple heterogeneous operating systemssimultaneously run on logical partitioned platform 200. These operatingsystems may be implemented using OS/400, which are designed to interfacewith a partition management firmware, such as Hypervisor. OS/400 is usedonly as an example in these illustrative embodiments. Of course, othertypes of operating systems, such as AIX and linux, may be used dependingon the particular implementation. Operating systems 202, 204, 206, and208 are located in partitions 203, 205, 207, and 209. Hypervisorsoftware is an example of software that may be used to implementpartition management firmware 210 and is available from InternationalBusiness Machines Corporation. Firmware is “software” stored in a memorychip that holds its content without electrical power, such as, forexample, read-only memory (ROM), programmable ROM (PROM), erasableprogrammable ROM (EPROM), electrically erasable programmable ROM(EEPROM), and nonvolatile random access memory (nonvolatile RAM).

Additionally, these partitions also include partition firmware 211, 213,215, and 217. Partition firmware 211, 213, 215, and 217 may beimplemented using initial boot strap code, IEEE-1275 Standard OpenFirmware, and runtime abstraction software (RTAS), which is availablefrom International Business Machines Corporation. When partitions 203,205, 207, and 209 are instantiated, a copy of boot strap code is loadedonto partitions 203, 205, 207, and 209 by platform firmware 210.Thereafter, control is transferred to the boot strap code with the bootstrap code then loading the open firmware and RTAS. The processorsassociated or assigned to the partitions are then dispatched to thepartition's memory to execute the partition firmware.

Partitioned hardware 230 includes a plurality of processors 232-238, aplurality of system memory units 240-246, a plurality of input/output(I/O) adapters 248-262, and a storage unit 270. Each of the processors232-238, memory units 240-246, NVRAM storage 298, and I/O adapters248-262 may be assigned to one of multiple partitions within logicalpartitioned platform 200, each of which corresponds to one of operatingsystems 202, 204, 206, and 208.

Partition management firmware 210 performs a number of functions andservices for partitions 203, 205, 207, and 209 to create and enforce thepartitioning of logical partitioned platform 200. Partition managementfirmware 210 is a firmware implemented virtual machine identical to theunderlying hardware. Thus, partition management firmware 210 allows thesimultaneous execution of independent OS images 202, 204, 206, and 208by virtualizing all the hardware resources of logical partitionedplatform 200.

Service processor 290 may be used to provide various services, such asprocessing of platform errors in the partitions. These services also mayact as a service agent to report errors back to a vendor, such asInternational Business Machines Corporation. Operations of the differentpartitions may be controlled through a hardware management console, suchas hardware management console 280. Hardware management console 280 is aseparate data processing system from which a system administrator mayperform various functions including reallocation of resources todifferent partitions.

FIG. 3 depicts a functional block diagram of a data processing systemwith a software bridge failover in accordance with an illustrativeembodiment of the present invention. Server 302 contains physicaladapter 308 that is connected to physical adapters 310 and 312 ofhosting partitions 304 and 306 through switch 314. In addition tohosting partitions 304 and 306 each containing a physical adapter,physical adapters 310 and 312 respectively, hosting partitions 304 and306 also each contain a software bridge, software bridges 316 and 318respectively, and a virtual adapter, virtual adapters 320 and 322respectively.

Virtual adapters 320 and 322 are connected to each other through one ormore virtual connections 324 and 326. However, as shown in FIG. 3, noteach of virtual adapters 334, 336, and 338 are connected to each ofvirtual connections 324 and 326. Thus, while logical partitions 328,330, and 332 may communicate with hosting partitions 304 and 306, theselogical partitions may not be able to directly communicate with eachother. Additionally, any communication from virtual adapter 334, 336,and 338 is only bridged by virtual adapter 320 and 322 that has primarycontrol.

In addition to software bridges 316 and 318 being able to communicatewith each other through virtual connections 324 and 326, softwarebridges 316 and 318 also are able to communicate through control channel340. One exemplary method of communicating over the control channel isvia standard Ethernet packets, although any type of packet communicationmay be employed. As an inventive aspect of the present invention,control channel 340 is a dedicated communication pipe between softwarebridges 316 and 318. Control channel 340 is used in a failover domain tocarry a failover protocol. Control channel 340 has no external trafficand is thus less prone to traffic loss or latency, but it is not assumedthat control channel 340 is a loss-less channel. Although controlchannel 340 is assumed to be loss-less, an exemplary type of loss may bedue to a Hypervisor being unable to copy the packet from one hostingpartition to another partition.

As another inventive aspect of the present invention is the use ofinherent administrator-assigned priority values 342 and 344 that areassociated with software bridges 316 and 318. Priority values 342 and344 are used to determine which of software bridges 316 and 318 in thefailover domain should declare primary software bridge status. Priorityvalues 342 and 344 are useful because the administrator is able todecide which of software bridges 316 and 318 are used preferentially asthe primary software bridge. The assignment of priorities also enablesthe assignment of more memory or a faster physical adapter to theprimary hosting partition than to the backup hosting partition. Althoughthe assignment of priorities is indicated as a manual assignment by anadministrator, assignments may also be dynamically assigned.

The failover protocol that is communicated between software bridges 316and 318 on communication channel 340 operates in the following manner.Although only two software bridges are shown in the following examples,more than two software bridges could also be supported. As an example,as software bridge 316 initializes, this bridge does not know whether itshould behave as the primary or as the backup. So, before softwarebridge 316 begins to bridge traffic, it listens on control channel 340for a few seconds to see if a keep-alive packet is received. Keep-alivepackets are protocol packets that are sent periodically and continuouslyon control channel 340 by the current primary software bridge, which issoftware bridge 318 in this example. The keep-alive packet informs theother software bridge in the failover domain that the primary softwarebridge is active and that no failover needs to occur. A keep-alivepacket contains the priority value of the software bridge that sends thepacket. In this example and the following examples, the keep-alivepacket includes a keep-alive flag field.

If while initializing, software bridge 316 does not receive anykeep-alive packets on control channel 340, software bridge 316 realizesit is the only software bridge in the failover domain, at least as ofyet, and asserts itself as the primary software bridge. Software bridge316 begins to bridge traffic for logical partitions 328, 330, and 332and begins sending keep-alive packets on control channel 340.

As another example, if software bridge 316 receives a keep-alive packeton control channel 340 with a priority value higher than priority value342, then software bridge 316 understands that software bridge 318 isthe current primary software bridge and asserts a backup status.

As another example, if software bridge 316 receives a keep-alive packeton control channel 340 with a priority value lower than priority value342, then software bridge 316 understands it should assert itself as theprimary software bridge. Software bridge 316 begins sending recoverypackets on control channel 340 to let software bridge 318 know thatanother software bridge with a higher priority will take over thebridging function. In this example and the following examples, therecovery packet is a protocol packet that includes a recovery flagfield. Software bridge 318 will respond with a notify packet on controlchannel 340 to let software bridge 316 know that software bridge 318 hasacknowledged the request and will yield to software bridge 316. In thisexample and the following examples, the notify packet is a protocolpacket that includes a notify flag field. At this point, software bridge316 asserts itself as the primary and begins bridging traffic. Softwarebridge 318 will then asserts backup status and stops bridging traffic.

As another example, if software bridge 316, now acting as the primarysoftware bridge, notices that physical adapter 310 is no longer working,either because there was an adapter failure or because the switch it wasconnected to has gone down, software bridge 316 begins sending limbopackets on control channel 340. In determining that physical adapter 310is no longer working, one exemplary method of determining the status ofa network adapter is to asynchronously notify a software bridge of a“link down status” event being detected on the physical adapter. Thelimbo packets alerts backup software bridge 318 that software bridge 316is no longer bridging, which causes software bridge 318 to take over asthe primary software bridge. In this example and the following examples,the limbo packet is a protocol packet that includes a limbo flag field.

As another example, if software bridge 318 acting as the backup noticesit has not received a keep-alive packet on control channel 340 in somepredetermined time, or if software bridge 318 receives limbo packets oncontrol channel 340, it knows that the software bridge 316 has gone downand that software bridge 318 must assert itself as the primary softwarebridge. Although the predetermined time may be a hard-coded or statictime interval, the predetermined time may also be any time interval thatis set by the software administrator. Software bridge 318 then startssending keep-alive packets on control channel 340 and begins bridgingall traffic.

FIG. 4 is a flowchart of a software bridge initialization in accordancewith an illustrative embodiment of the present invention. The softwarebridge described in the following example may be any software bridgessuch as software bridges 316 and 318 in FIG. 3. As the operation begins,a data processing system is started and the software bridge isinitialized (step 402). Before bridging traffic, the software bridgelistens on a control channel for a few seconds for keep-alive packets(step 404). If the software bridge does not receive any keep-alivepackets (step 404), the software bridge realizes it is the only softwarebridge in the failover domain, at least as of yet, and asserts itself asthe primary software bridge (step 412). The software bridge begins tobridge traffic for the internal logical partitions and begins sendingkeep-alive packets on the control channel. The operation then proceedsto a primary control software bridge operation that is described in FIG.5.

If at step 404, the software bridge receives a keep-alive packet, thesoftware bridge determines if the priority denoted in the keep-alivepacket is higher than the assigned priority value of the software bridge(step 406). If the priority value in the keep-alive packet is higher(step 406), then the software bridge asserts a backup status andcontinues to keep reading incoming packets (step 414). The operationthen proceeds to a backup software bridge operation that is described inFIG. 6.

If at step 406, the priority value in the keep-alive packet is apriority lower than the priority value the software bridge is assigned,then the software bridge starts sending recovery packets on the controlchannel to the current primary software bridge to let the currentprimary software bridge know another software bridge with a higherpriority will take over the bridging function (step 408). The softwarebridge waits for a notify packet from the current primary softwarebridge and, once a notify packet is received, the software bridgeasserts a primary status, begins bridging traffic, and starts sendingkeep-alive packets (step 410). The operation then proceeds to a primarycontrol software bridge operation that is described in FIG. 5.

FIG. 5 is a flowchart of a primary software bridge operation inaccordance with an illustrative embodiment of the present invention. Thesoftware bridge described in the following example may be any softwarebridges such as software bridges 316 and 318 in FIG. 3. As the primarysoftware bridge operation begins, the current primary software bridgecontinually monitors its associated physical adapter to determine if thephysical adapter is working properly (step 502). If the physical adapteris working properly, the operation continues to monitor the physicaladapter. If the physical adapter is no longer working, then the currentprimary software bridge begins sending limbo packets on the controlchannel (step 504). The limbo packets alert the current backup softwarebridge that the current primary software bridge is no longer bridgingand needs the current backup software bridge to take over as the primarysoftware bridge.

The current backup software bridge responds to the current primarysoftware bridge with keep-alive packets on the control channel to letthe current primary software bridge know that another software bridgewill take over the bridging function. The current primary softwarebridge determines if it has received a keep-alive packet (step 506). Ifthe current primary software bridge has not received a keep-alive packet(step 506), the current primary software bridge continues to send limbopackets (step 504). If at step 506, the current primary software bridgereceives a keep-alive packet, then the current primary software bridgestops sending out limbo packets, asserts a limbo status, and stopsbridging traffic (step 508).

FIG. 6 is a flowchart of a backup software bridge operation inaccordance with an illustrative embodiment of the present invention. Thesoftware bridge described in the following example may be any softwarebridges such as software bridges 316 and 318 in FIG. 3. As the backupsoftware bridge operation begins, the current backup software bridgemonitors the control channel for keep-alive packets (step 602). If thecurrent backup software bridge determines that it has not received akeep-alive packet in some predetermined time (step 602), the currentbackup software bridge realizes the current primary software bridge hasgone down, asserts primary control, bridges traffic, and starts sendingkeep-alive packets (step 610).

If at step 602 the current backup software bridge is receivingkeep-alive packets, then a determination is made as to whether thecurrent backup software bridge receives limbo packets from the currentprimary software bridge (step 604). If at step 604, the current backupsoftware bridge receives limbo packets, the current backup softwarebridge asserts primary control, begins bridging traffic, and startssending out keep-alive packets. If the current backup software bridgehas not received limbo packets then the current backup software bridgecontinues to monitor the control channel at step 602.

The aspects of the present invention provide for a protocol definitionfor software bridge failover. The proper working operation of a physicaladapter in a first software bridge is determined. In response to thephysical adapter failure in the first software bridge, limbo packets aresent to a second software bridge alerting the second software bridgethat the first software bridge is no longer bridging traffic. The secondsoftware bridge asserts primary control and initiates bridging oftraffic in response to the receipt of the limbo packets.

The invention can take the form of an entirely hardware embodiment, anentirely software embodiment or an embodiment containing both hardwareand software elements. In a preferred embodiment, the invention isimplemented in software, which includes but is not limited to firmware,resident software, microcode, etc.

Furthermore, the invention can take the form of a computer programproduct accessible from a computer-usable or computer-readable mediumproviding program code for use by or in connection with a computer orany instruction execution system. For the purposes of this description,a computer-usable or computer readable medium can be any apparatus thatcan contain, store, communicate, propagate, or transport the program foruse by or in connection with the instruction execution system,apparatus, or device.

The medium can be an electronic, magnetic, optical, electromagnetic,infrared, or semiconductor system (or apparatus or device) or apropagation medium. Examples of a computer-readable medium include asemiconductor or solid state memory, magnetic tape, a removable computerdiskette, a random access memory (RAM), a read-only memory (ROM), arigid magnetic disk and an optical disk. Current examples of opticaldisks include compact disk-read only memory (CD-ROM), compactdisk-read/write (CD-R/W) and DVD.

A data processing system suitable for storing and/or executing programcode will include at least one processor coupled directly or indirectlyto memory elements through a system bus. The memory elements can includelocal memory employed during actual execution of the program code, bulkstorage, and cache memories which provide temporary storage of at leastsome program code in order to reduce the number of times code must beretrieved from bulk storage during execution.

Input/output or I/O devices (including but not limited to keyboards,displays, pointing devices, etc.) can be coupled to the system eitherdirectly or through intervening I/O controllers.

Network adapters may also be coupled to the system to enable the dataprocessing system to become coupled to other data processing systems orremote printers or storage devices through intervening private or publicnetworks. Modems, cable modem and Ethernet cards are just a few of thecurrently available types of network adapters.

The description of the present invention has been presented for purposesof illustration and description, and is not intended to be exhaustive orlimited to the invention in the form disclosed. Many modifications andvariations will be apparent to those of ordinary skill in the art. Theembodiment was chosen and described in order to best explain theprinciples of the invention, the practical application, and to enableothers of ordinary skill in the art to understand the invention forvarious embodiments with various modifications as are suited to theparticular use contemplated.

1. A computer implemented method for providing a protocol definition forsoftware bridge failover in a logical partition data processing system,the method comprising: sending keep-alive packets by the first softwarebridge to the second software bridge, wherein the keep-alive packets areprotocol packets that are sent periodically and continuously on acontrol channel, and wherein a first keep-alive packet contains apriority value of the first software bridge; monitoring, by the secondsoftware bridge, the keep-alive packets, wherein the keep-alive packetinforms the second software bridge that the first software bridge isactive and that failover is not necessary; responsive to a failure todetect the keep-alive packets from the first software bridge, initiatingthe bridging of traffic by the second software bridge; initiating thefirst software bridge; monitoring the first software bridge for thekeep-alive packets on the control channel; responsive to the failure toreceive the keep-alive packets, asserting primary control by the firstsoftware bridge; initiating bridging of traffic by the first softwarebridge; responsive to receiving the keep-alive packets, determining ifthe keep-alive packets contain a higher priority value than the priorityvalue of the first software bridge; responsive to the keep-alive packetscontaining the higher priority value, asserting backup status by thefirst software bridge; monitoring the control channel by the firstsoftware bridge; responsive to the keep-alive packets containing a lowerpriority value than the priority value of the first software bridge,asserting primary control by the first software bridge; and initiatingthe bridging of traffic by the first software bridge; monitoring for afailure in a first software bridge; responsive to detecting the failurein the first software bridge, sending a limbo packet to a secondsoftware bridge alerting the second software bridge that the firstsoftware bridge is no longer bridging traffic, wherein the failure inthe first software bridge is a physical adapter failure; receiving atthe second software bridge the limbo packet; responsive to receiving thelimbo packet at the second software bridge, initiating bridging oftraffic by a second software bridge in place of the first softwarebridge; and asserting primary control by the second software bridge.